Randy wrote:
Charles Gregory wrote:
Just a quick question:
I'm noticing that these 'png' spams don't have a text section, or any
message body text, and yet my SA does not trigger on any 'message does
not contain text' rules? I've seen rules trigger when messages are a
high percentage of image versus text, but why no hits when 100% image?
- Charles
These hit the EMPTY_MESSAGE rule for me.
I had one sneak through today which didn't hit any rules at all (it hits
a few DNSBLs now but not when I received it). It contained an inline png:
Content-Type: image/png
Content-Transfer-Encoding: base64
Content-Disposition: inline
here's the full message:
http://pastebin.com/m608defa5
Any idea how to tackle these? I have the DSCxxxx png rule in place but
obviously that doesn't apply to this example.
Perhaps I need a rule for "Content-Type: image/png" too?
